How a carelessly maintained campaign website exposed me to identity theft

And what you can do about it

A true story by Greg Scott, Infrasupport CTO

After being persuaded by friends and family to become more involved with the future of my country, I registered with a political campaign back in 2006. I started receiving emails from this particular campaign and slowly began to feel like a privileged insider.

On March 10, 2009, that all changed when I received a different kind of email from a controversial whistleblower organization named Wikileaks. The email started out like this:

I was shocked. My name and personal, private information were now on a list circulating around the Internet, and this had evidently been going on for at least 6 weeks prior to that time without my consent or knowledge. Fortunately for me, I never donated online and the only information about me in the list was a name and email address.

Evidently, many others who donated online with credit cards were not so fortunate. Imagine donating online to a political campaign or other organization, only to find out months or years later that you may be risk of identity theft because of it - and learning about the problem not from the campaign, but from a whistle blower organization.

I did some homework and found out this campaign website had been sloppily maintained and the assurances from the campaign around privacy protection were hollow.

Operating a website in this manner is a lousy way to win friends and influence people.

If you use a website to register supporters or customers, please take appropriate steps to protect the data you collect. Lip service and sloppy security will get you in deep trouble and generate publicity you don't want.

My name is Greg Scott. I have been an IT professional since 1979. I do IT security for a living and I recently passed a grueling CISSP (Certified Information Systems Security Professional), exam to prove it.

I can help you reduce this risk to your credibility. Call me at (651) 260-1051 or email me at GregScott@Infrasupport.com.

Trust your critical information to a professional. Your supporters are counting on you.